solana-restaking[.]com

Analysis of solana-restaking.com shows a newly registered domain (created 30 May 2025) that leverages Cloudflare’s infrastructure (IP 104.21.64.1, ASN 13335) and presents a page title “Solana Restaking”. The domain was issued through NiceNIC International Group Co., Limited and uses Google Trust Services certificates, indicating a valid TLS chain. Two of ninety‑five VirusTotal scanners flagged the site, and a Gridinsoft trust score of 0 / 100 reflects a high risk rating. The domain appears on at least one phishing blocklist and is actively blocked by PhishDestroy, confirming that security operators have observed malicious activity.

Mailgun detection suggests the site may have been used for outbound email campaigns, while the MX records point to Zoho EU mail services, a common choice for abuse actors. The listed threat category is a crypto scam that impersonates the Solana brand, matching the page title and the declared brand target. The site is currently taken offline, preventing further content retrieval, but the infrastructure elements—Cloudflare fronting, legitimate‑looking TLS, and the use of popular email services—are typical of brand‑impersonation campaigns that aim to convince victims of authenticity.

Defenders should continue to block the domain and its IP, monitor for re‑hosting on other Cloudflare edge nodes, and add the domain to internal threat feeds. Additional scrutiny of any future DNS changes or certificate re‑issuance is recommended, as the actors could reactivate the domain with similar tactics. Until the site is confirmed clean, any contact that references “Solana Restaking” should be treated as suspicious.